VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 12.0.x prior to 12.2.0. It is, therefore, affected by a vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 16.0.x prior to 16.2.0. It is, therefore, affected by a vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by a heap overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

VMware Workstation contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

VMware Fusion contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
200997	VMware Fusion 12.0.x < 12.2.0 Vulnerability (VMSA-2022-0001.2)	Nessus	MacOS X Local Security Checks	Local	high
200996	VMware Workstation 16.0.x < 16.2.0 Vulnerability (VMSA-2022-0001.2)	Nessus	General	Local	high
165337	ESXi 6.5 / 6.7 / 7.0 Heap Overflow RCE (VMSA-2022-0001)	Nessus	Misc.	Remote	high
157422	VMware Workstation 16.0.x < 16.2.0 Heap Overflow RCE (VMSA-2022-0001)	Nessus	General	Local	high
157421	VMware Fusion 12.x < 12.2.0 Heap Overflow RCE (VMSA-2022-0001)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2021-22045

high

Tenable Plugins

high

high

high

high

high